Google Blogger- Insecure Implementation of Request Limiter | Google Honourable Mentions | Rishu Ranjan
Acknowledgment: Google Honourable Mentions (https://bughunter.withgoogle.com/rank/hm/9)
Steps to reproduce:Implementation of Request Limiters
1. Open blogger profile(above mentioned URL) and note the profile view count as shown in Exhibit-1.
3. Send the captured request to Burp intruder as shown in Exhibit-2 and set the payload(null) to 1000 which will send 1000 requests to the server (Exhibit-3).
5. To bypass the security implementation, send the blocks of requests PARALLELY to the server with each block containing 299 requests as shown in Exhibit-5.